ihucos

18 ms·

91.
Show HN: Virtualenv for everything(github.com)
2 points by ihucos 6y ago|1 comments
92.
Corona dashboards with Chart.js (Germany focused)(corona-aktuell.net)
1 points by ihucos 6y ago|0 comments
93.
by ihucos 7y ago
Why TTY in the name, exit codes are returned by processes, regardless if they opened a TTY or not.
94.
by ihucos 7y ago
For my personal project ( http://plash.io/ ) I try to archive something similar by: * Only use technology that already exists for at least 10 years and is widely used: bash python3 C and Linux * No external libraries, only th
95.
by ihucos 7y ago
Generally it could be possible to run single (bloated) applications inside a container. Here is the solution I wrote for Linux: http://zpkg.plash.io/
96.
Zpkg – use packages from other distros(zpkg.plash.io)
4 points by ihucos 7y ago|0 comments
97.
Show HN: zpkg: use applications from other distros(github.com)
1 points by ihucos 8y ago|0 comments
98.
by ihucos 8y ago
neither avenv nor bchroot (nor chroot by the way) claim any security gain. Bugs are in this case just bugs and I'll fix them. bchroot is ~ 200 lines C, avenv is 60 lines shell scripting. It's really no big deal. But aren't we
99.
by ihucos 8y ago
> > > I have some concerns about binding /tmp and /dev the way you do... > > Can you elaborate what exactly the issues is? I use this quite often. > It's a container escape. The chroot shouldn't be able
100.
by ihucos 8y ago
The whole shell script is really just because it's a protoype (=Initial commit). If I get good feedback, I'll rewrite this in proper python code. At least for myself it's already good enough to use it. The thing that worries
101.
by ihucos 8y ago
To my haters: It's clearly a prototype. 60 lines of shell script will always have their own issues. What I'd love to hear is thoughts on the general approach! Is this cool enough to do proper?
102.
by ihucos 8y ago
This also works with others package managers/distributions. Only with apt/apt-get you need some extra configuration "APT::Sandbox::User=root" I was thinking about using Ubuntu, but in the end took void linux because it&#
103.
Show HN: Avenv – A more isolated virtualenv(github.com)
20 points by ihucos 8y ago|18 comments
104.
Show HN: Standalone Containers(github.com)
6 points by ihucos 8y ago|0 comments
105.
by ihucos 8y ago
check it out, there are some recipes now.
106.
by ihucos 8y ago
Maybe let me try something like this: Thread < Process < Plash < Container < Full virtualization < Dedicated Hardware Plash is conceptually somewhere between containers as they existed until now and operating system processes
107.
by ihucos 8y ago
Not particular strong ones. I actually imagined that .txt is more accessible, maybe the wrapping must be tighter. I like it because its very WYSIWYG. The UTF-8 art looks better there than in a code block. And it's one little dependency
108.
by ihucos 8y ago
Yeah I don't know, the terms a a little mixed up. For me isolation and sandboxing is not the same. A function of a container is to provide a more well defined environment, usually for other application to run more reliable. That by its
109.
by ihucos 8y ago
> I think you can already build Docker images via Docker within travis CI, [...] The nice think about plash is that you don't have to worry about "official" support. > [...] due to /sys being read-only. Dammit, no,
110.
by ihucos 8y ago
To continue the reply... plash uses along others linux namespaces and chroot. So inside a linux namespace you can actually use the vanilla chroot: ihucos@macbook:~/plash$ # get an example rootfs ihucos@macbook:~/plash$ mkdir
111.
by ihucos 8y ago
Thank you :-) > Does that mean I can build container images within a running container (for example the GitLab-CI) without doing a stunt like docker-in-docker or fakechroot/fakeroot? Sure, plash's unit tests involve building an
112.
by ihucos 8y ago
> So does Docker now provide containers that can guarantee immunity from (certain) privilege escalation attacks? In my opinion the isolation mechanism of major container software like docker is flawed and thinking about it gives me heada
113.
by ihucos 8y ago
Oh boy, I am since one hour thinking about how to formulate it so its really crystal clear, maybe someone have a suggestion. In my head isolation and containerization are two completely different problems. If you really want "complete&
114.
by ihucos 8y ago
gVisor is primarly focused on isolation, plash actually only wants to containerize processes and leaves optional isolation to other tools if required (potentially gVisor). To quote gVisor: Containers are not a sandbox. While containers
115.
by ihucos 8y ago
Hey, Yeah, that should work. It usually uses linux namespaces/overlay/unionfs/mount/chroot there are no dependencies on hyper-V. In the worst case scenario plash would also be happy with not cleaning up mountpoints (PLAS
116.
by ihucos 8y ago
Yep true. I am still trying to figure out how to write good documentation/tutorials. I will definitely write some general recipes in the README for common tasks, some also doable in other container software like mounting containers, im
117.
by ihucos 8y ago
I think the simplest would be like this: ihucos@macbook:~$ docker run --privileged --volume /var/lib/plash -ti python bash root@d2a59ae96bc2:/# pip3 install plash Collecting plash Downloading https:/&#x2
118.
by ihucos 8y ago
Good morning, it certainly would be very nice. I explored this a little bit but on the end had to focus on stability of the core components. It wouldn't be anything too hard, but quite a lot of work to implement all the syntax quirks,
119.
Stop hitting ESC in Vim
3 points by ihucos 8y ago|2 comments
120.
Show HN: Plash – Build and run containers(github.com)
66 points by ihucos 8y ago|30 comments

More ›